@toon-protocol/client-mcp 0.20.2 → 0.20.4

package/dist/chunk-V7D5HJBT.js

@@ -0,0 +1,1363 @@
+import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
+import {
+  FpInvertBatch,
+  FpSqrtEven,
+  _DST_scalar,
+  aInRange,
+  abool,
+  abytes,
+  abytes2,
+  asafenumber,
+  asciiToBytes,
+  bytesToHex2 as bytesToHex,
+  bytesToNumberBE,
+  bytesToNumberLE,
+  concatBytes,
+  concatBytes2,
+  copyBytes,
+  createCurveFields,
+  createFROST,
+  createHasher2 as createHasher,
+  createKeygen,
+  equalBytes,
+  expand_message_xmd,
+  getMinHashLength,
+  hexToBytes,
+  hexToBytes2,
+  isBytes,
+  isNegativeLE,
+  mapHashToField,
+  mod,
+  normalizeZ,
+  notImplemented,
+  numberToBytesBE,
+  numberToBytesLE,
+  pippenger,
+  pow2,
+  randomBytes2 as randomBytes,
+  sha512,
+  validateObject,
+  validatePointCons,
+  wNAF
+} from "./chunk-6GXZ4KRO.js";
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/edwards.js
+var _0n = /* @__PURE__ */ BigInt(0);
+var _1n = /* @__PURE__ */ BigInt(1);
+var _2n = /* @__PURE__ */ BigInt(2);
+var _8n = /* @__PURE__ */ BigInt(8);
+function isEdValidXY(Fp2, CURVE, x, y) {
+  const x2 = Fp2.sqr(x);
+  const y2 = Fp2.sqr(y);
+  const left = Fp2.add(Fp2.mul(CURVE.a, x2), y2);
+  const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x2, y2)));
+  return Fp2.eql(left, right);
+}
+function edwards(params, extraOpts = {}) {
+  const opts = extraOpts;
+  const validated = createCurveFields("edwards", params, opts, opts.FpFnLE);
+  const { Fp: Fp2, Fn: Fn2 } = validated;
+  let CURVE = validated.CURVE;
+  const { h: cofactor } = CURVE;
+  validateObject(opts, {}, { uvRatio: "function" });
+  const MASK = _2n << BigInt(Fn2.BYTES * 8) - _1n;
+  const modP = (n) => Fp2.create(n);
+  const uvRatio2 = opts.uvRatio === void 0 ? (u, v) => {
+    try {
+      return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
+    } catch (e) {
+      return { isValid: false, value: _0n };
+    }
+  } : opts.uvRatio;
+  if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
+    throw new Error("bad curve params: generator point");
+  function acoord(title, n, banZero = false) {
+    const min = banZero ? _1n : _0n;
+    aInRange("coordinate " + title, n, min, MASK);
+    return n;
+  }
+  function aedpoint(other) {
+    if (!(other instanceof Point))
+      throw new Error("EdwardsPoint expected");
+  }
+  class Point {
+    // base / generator point
+    static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));
+    // zero / infinity / identity point
+    static ZERO = new Point(_0n, _1n, _1n, _0n);
+    // 0, 1, 1, 0
+    // math field
+    static Fp = Fp2;
+    // scalar field
+    static Fn = Fn2;
+    X;
+    Y;
+    Z;
+    T;
+    constructor(X, Y, Z, T) {
+      this.X = acoord("x", X);
+      this.Y = acoord("y", Y);
+      this.Z = acoord("z", Z, true);
+      this.T = acoord("t", T);
+      Object.freeze(this);
+    }
+    static CURVE() {
+      return CURVE;
+    }
+    /**
+     * Create one extended Edwards point from affine coordinates.
+     * Does NOT validate that the point is on-curve or torsion-free.
+     * Use `.assertValidity()` on adversarial inputs.
+     */
+    static fromAffine(p) {
+      if (p instanceof Point)
+        throw new Error("extended point not allowed");
+      const { x, y } = p || {};
+      acoord("x", x);
+      acoord("y", y);
+      return new Point(x, y, _1n, modP(x * y));
+    }
+    // Uses algo from RFC8032 5.1.3.
+    static fromBytes(bytes, zip215 = false) {
+      const len = Fp2.BYTES;
+      const { a, d } = CURVE;
+      bytes = copyBytes(abytes2(bytes, len, "point"));
+      abool(zip215, "zip215");
+      const normed = copyBytes(bytes);
+      const lastByte = bytes[len - 1];
+      normed[len - 1] = lastByte & ~128;
+      const y = bytesToNumberLE(normed);
+      const max = zip215 ? MASK : Fp2.ORDER;
+      aInRange("point.y", y, _0n, max);
+      const y2 = modP(y * y);
+      const u = modP(y2 - _1n);
+      const v = modP(d * y2 - a);
+      let { isValid, value: x } = uvRatio2(u, v);
+      if (!isValid)
+        throw new Error("bad point: invalid y coordinate");
+      const isXOdd = (x & _1n) === _1n;
+      const isLastByteOdd = (lastByte & 128) !== 0;
+      if (!zip215 && x === _0n && isLastByteOdd)
+        throw new Error("bad point: x=0 and x_0=1");
+      if (isLastByteOdd !== isXOdd)
+        x = modP(-x);
+      return Point.fromAffine({ x, y });
+    }
+    static fromHex(hex, zip215 = false) {
+      return Point.fromBytes(hexToBytes2(hex), zip215);
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    precompute(windowSize = 8, isLazy = true) {
+      wnaf.createCache(this, windowSize);
+      if (!isLazy)
+        this.multiply(_2n);
+      return this;
+    }
+    // Useful in fromAffine() - not for fromBytes(), which always created valid points.
+    assertValidity() {
+      const p = this;
+      const { a, d } = CURVE;
+      if (p.is0())
+        throw new Error("bad point: ZERO");
+      const { X, Y, Z, T } = p;
+      const X2 = modP(X * X);
+      const Y2 = modP(Y * Y);
+      const Z2 = modP(Z * Z);
+      const Z4 = modP(Z2 * Z2);
+      const aX2 = modP(X2 * a);
+      const left = modP(Z2 * modP(aX2 + Y2));
+      const right = modP(Z4 + modP(d * modP(X2 * Y2)));
+      if (left !== right)
+        throw new Error("bad point: equation left != right (1)");
+      const XY = modP(X * Y);
+      const ZT = modP(Z * T);
+      if (XY !== ZT)
+        throw new Error("bad point: equation left != right (2)");
+    }
+    // Compare one point to another.
+    equals(other) {
+      aedpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      const X1Z2 = modP(X1 * Z2);
+      const X2Z1 = modP(X2 * Z1);
+      const Y1Z2 = modP(Y1 * Z2);
+      const Y2Z1 = modP(Y2 * Z1);
+      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+    }
+    is0() {
+      return this.equals(Point.ZERO);
+    }
+    negate() {
+      return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
+    }
+    // Fast algo for doubling Extended Point.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+    // Cost: 4M + 4S + 1*a + 6add + 1*2.
+    double() {
+      const { a } = CURVE;
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const A = modP(X1 * X1);
+      const B = modP(Y1 * Y1);
+      const C = modP(_2n * modP(Z1 * Z1));
+      const D = modP(a * A);
+      const x1y1 = X1 + Y1;
+      const E = modP(modP(x1y1 * x1y1) - A - B);
+      const G = D + B;
+      const F = G - C;
+      const H = D - B;
+      const X3 = modP(E * F);
+      const Y3 = modP(G * H);
+      const T3 = modP(E * H);
+      const Z3 = modP(F * G);
+      return new Point(X3, Y3, Z3, T3);
+    }
+    // Fast algo for adding 2 Extended Points.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+    // Cost: 9M + 1*a + 1*d + 7add.
+    add(other) {
+      aedpoint(other);
+      const { a, d } = CURVE;
+      const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
+      const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
+      const A = modP(X1 * X2);
+      const B = modP(Y1 * Y2);
+      const C = modP(T1 * d * T2);
+      const D = modP(Z1 * Z2);
+      const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
+      const F = D - C;
+      const G = D + C;
+      const H = modP(B - a * A);
+      const X3 = modP(E * F);
+      const Y3 = modP(G * H);
+      const T3 = modP(E * H);
+      const Z3 = modP(F * G);
+      return new Point(X3, Y3, Z3, T3);
+    }
+    subtract(other) {
+      aedpoint(other);
+      return this.add(other.negate());
+    }
+    // Constant-time multiplication.
+    multiply(scalar) {
+      if (!Fn2.isValidNot0(scalar))
+        throw new RangeError("invalid scalar: expected 1 <= sc < curve.n");
+      const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
+      return normalizeZ(Point, [p, f])[0];
+    }
+    // Non-constant-time multiplication. Uses double-and-add algorithm.
+    // It's faster, but should only be used when you don't care about
+    // an exposed private key e.g. sig verification.
+    // Keeps the same subgroup-scalar contract: 0 is allowed for public-scalar callers, but
+    // n and larger values are rejected instead of being reduced mod n to the identity point.
+    multiplyUnsafe(scalar) {
+      if (!Fn2.isValid(scalar))
+        throw new RangeError("invalid scalar: expected 0 <= sc < curve.n");
+      if (scalar === _0n)
+        return Point.ZERO;
+      if (this.is0() || scalar === _1n)
+        return this;
+      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p));
+    }
+    // Checks if point is of small order.
+    // If you add something to small order point, you will have "dirty"
+    // point with torsion component.
+    // Clears cofactor and checks if the result is 0.
+    isSmallOrder() {
+      return this.clearCofactor().is0();
+    }
+    // Multiplies point by curve order and checks if the result is 0.
+    // Returns `false` is the point is dirty.
+    isTorsionFree() {
+      return wnaf.unsafe(this, CURVE.n).is0();
+    }
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    toAffine(invertedZ) {
+      const p = this;
+      let iz = invertedZ;
+      const { X, Y, Z } = p;
+      const is0 = p.is0();
+      if (iz == null)
+        iz = is0 ? _8n : Fp2.inv(Z);
+      const x = modP(X * iz);
+      const y = modP(Y * iz);
+      const zz = Fp2.mul(Z, iz);
+      if (is0)
+        return { x: _0n, y: _1n };
+      if (zz !== _1n)
+        throw new Error("invZ was invalid");
+      return { x, y };
+    }
+    clearCofactor() {
+      if (cofactor === _1n)
+        return this;
+      return this.multiplyUnsafe(cofactor);
+    }
+    toBytes() {
+      const { x, y } = this.toAffine();
+      const bytes = Fp2.toBytes(y);
+      bytes[bytes.length - 1] |= x & _1n ? 128 : 0;
+      return bytes;
+    }
+    toHex() {
+      return bytesToHex(this.toBytes());
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+  }
+  const wnaf = new wNAF(Point, Fn2.BITS);
+  if (Fn2.BITS >= 8)
+    Point.BASE.precompute(8);
+  Object.freeze(Point.prototype);
+  Object.freeze(Point);
+  return Point;
+}
+var PrimeEdwardsPoint = class {
+  static BASE;
+  static ZERO;
+  static Fp;
+  static Fn;
+  ep;
+  /**
+   * Wrap one internal Edwards representative directly.
+   * This is not a canonical encoding boundary: alternate Edwards
+   * representatives may still describe the same abstract wrapper element.
+   */
+  constructor(ep) {
+    this.ep = ep;
+  }
+  // Static methods that must be implemented by subclasses
+  static fromBytes(_bytes) {
+    notImplemented();
+  }
+  static fromHex(_hex) {
+    notImplemented();
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
+  }
+  // Common implementations
+  clearCofactor() {
+    return this;
+  }
+  assertValidity() {
+    this.ep.assertValidity();
+  }
+  /**
+   * Return affine coordinates of the current internal Edwards representative.
+   * This is a convenience helper, not a canonical Ristretto/Decaf encoding.
+   * Equal abstract elements may expose different `x` / `y`; use
+   * `toBytes()` / `fromBytes()` for canonical roundtrips.
+   */
+  toAffine(invertedZ) {
+    return this.ep.toAffine(invertedZ);
+  }
+  toHex() {
+    return bytesToHex(this.toBytes());
+  }
+  toString() {
+    return this.toHex();
+  }
+  isTorsionFree() {
+    return true;
+  }
+  isSmallOrder() {
+    return false;
+  }
+  add(other) {
+    this.assertSame(other);
+    return this.init(this.ep.add(other.ep));
+  }
+  subtract(other) {
+    this.assertSame(other);
+    return this.init(this.ep.subtract(other.ep));
+  }
+  multiply(scalar) {
+    return this.init(this.ep.multiply(scalar));
+  }
+  multiplyUnsafe(scalar) {
+    return this.init(this.ep.multiplyUnsafe(scalar));
+  }
+  double() {
+    return this.init(this.ep.double());
+  }
+  negate() {
+    return this.init(this.ep.negate());
+  }
+  precompute(windowSize, isLazy) {
+    this.ep.precompute(windowSize, isLazy);
+    return this;
+  }
+};
+function eddsa(Point, cHash, eddsaOpts = {}) {
+  if (typeof cHash !== "function")
+    throw new Error('"hash" function param is required');
+  const hash = cHash;
+  const opts = eddsaOpts;
+  validateObject(opts, {}, {
+    adjustScalarBytes: "function",
+    randomBytes: "function",
+    domain: "function",
+    prehash: "function",
+    zip215: "boolean",
+    mapToCurve: "function"
+  });
+  const { prehash } = opts;
+  const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
+  const outputLen = hash.outputLen;
+  const expectedLen = 2 * Fp2.BYTES;
+  if (outputLen !== void 0) {
+    asafenumber(outputLen, "hash.outputLen");
+    if (outputLen !== expectedLen)
+      throw new Error(`hash.outputLen must be ${expectedLen}, got ${outputLen}`);
+  }
+  const randomBytes2 = opts.randomBytes === void 0 ? randomBytes : opts.randomBytes;
+  const adjustScalarBytes2 = opts.adjustScalarBytes === void 0 ? (bytes) => bytes : opts.adjustScalarBytes;
+  const domain = opts.domain === void 0 ? (data, ctx, phflag) => {
+    abool(phflag, "phflag");
+    if (ctx.length || phflag)
+      throw new Error("Contexts/pre-hash are not supported");
+    return data;
+  } : opts.domain;
+  function modN_LE(hash2) {
+    return Fn2.create(bytesToNumberLE(hash2));
+  }
+  function getPrivateScalar(key) {
+    const len = lengths.secretKey;
+    abytes2(key, lengths.secretKey, "secretKey");
+    const hashed = abytes2(hash(key), 2 * len, "hashedSecretKey");
+    const head = adjustScalarBytes2(hashed.slice(0, len));
+    const prefix = hashed.slice(len, 2 * len);
+    const scalar = modN_LE(head);
+    return { head, prefix, scalar };
+  }
+  function getExtendedPublicKey(secretKey) {
+    const { head, prefix, scalar } = getPrivateScalar(secretKey);
+    const point = BASE.multiply(scalar);
+    const pointBytes = point.toBytes();
+    return { head, prefix, scalar, point, pointBytes };
+  }
+  function getPublicKey(secretKey) {
+    return getExtendedPublicKey(secretKey).pointBytes;
+  }
+  function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {
+    const msg = concatBytes2(...msgs);
+    return modN_LE(hash(domain(msg, abytes2(context, void 0, "context"), !!prehash)));
+  }
+  function sign(msg, secretKey, options = {}) {
+    msg = abytes2(msg, void 0, "message");
+    if (prehash)
+      msg = prehash(msg);
+    const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
+    const r = hashDomainToScalar(options.context, prefix, msg);
+    const R = BASE.multiply(r).toBytes();
+    const k = hashDomainToScalar(options.context, R, pointBytes, msg);
+    const s = Fn2.create(r + k * scalar);
+    if (!Fn2.isValid(s))
+      throw new Error("sign failed: invalid s");
+    const rs = concatBytes2(R, Fn2.toBytes(s));
+    return abytes2(rs, lengths.signature, "result");
+  }
+  const verifyOpts = {
+    zip215: opts.zip215
+  };
+  function verify(sig, msg, publicKey, options = verifyOpts) {
+    const { context } = options;
+    const zip215 = options.zip215 === void 0 ? !!verifyOpts.zip215 : options.zip215;
+    const len = lengths.signature;
+    sig = abytes2(sig, len, "signature");
+    msg = abytes2(msg, void 0, "message");
+    publicKey = abytes2(publicKey, lengths.publicKey, "publicKey");
+    if (zip215 !== void 0)
+      abool(zip215, "zip215");
+    if (prehash)
+      msg = prehash(msg);
+    const mid = len / 2;
+    const r = sig.subarray(0, mid);
+    const s = bytesToNumberLE(sig.subarray(mid, len));
+    let A, R, SB;
+    try {
+      A = Point.fromBytes(publicKey, zip215);
+      R = Point.fromBytes(r, zip215);
+      SB = BASE.multiplyUnsafe(s);
+    } catch (error) {
+      return false;
+    }
+    if (!zip215 && A.isSmallOrder())
+      return false;
+    const k = hashDomainToScalar(context, r, publicKey, msg);
+    const RkA = R.add(A.multiplyUnsafe(k));
+    return RkA.subtract(SB).clearCofactor().is0();
+  }
+  const _size = Fp2.BYTES;
+  const lengths = {
+    secretKey: _size,
+    publicKey: _size,
+    signature: 2 * _size,
+    seed: _size
+  };
+  function randomSecretKey(seed) {
+    seed = seed === void 0 ? randomBytes2(lengths.seed) : seed;
+    return abytes2(seed, lengths.seed, "seed");
+  }
+  function isValidSecretKey(key) {
+    return isBytes(key) && key.length === lengths.secretKey;
+  }
+  function isValidPublicKey(key, zip215) {
+    try {
+      return !!Point.fromBytes(key, zip215 === void 0 ? verifyOpts.zip215 : zip215);
+    } catch (error) {
+      return false;
+    }
+  }
+  const utils = {
+    getExtendedPublicKey,
+    randomSecretKey,
+    isValidSecretKey,
+    isValidPublicKey,
+    /**
+     * Converts ed public key to x public key. Uses formula:
+     * - ed25519:
+     *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`
+     *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`
+     * - ed448:
+     *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`
+     *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`
+     */
+    toMontgomery(publicKey) {
+      const { y } = Point.fromBytes(publicKey);
+      const size = lengths.publicKey;
+      const is25519 = size === 32;
+      if (!is25519 && size !== 57)
+        throw new Error("only defined for 25519 and 448");
+      const u = is25519 ? Fp2.div(_1n + y, _1n - y) : Fp2.div(y - _1n, y + _1n);
+      return Fp2.toBytes(u);
+    },
+    toMontgomerySecret(secretKey) {
+      const size = lengths.secretKey;
+      abytes2(secretKey, size);
+      const hashed = hash(secretKey.subarray(0, size));
+      return adjustScalarBytes2(hashed).subarray(0, size);
+    }
+  };
+  Object.freeze(lengths);
+  Object.freeze(utils);
+  return Object.freeze({
+    keygen: createKeygen(randomSecretKey, getPublicKey),
+    getPublicKey,
+    sign,
+    verify,
+    utils,
+    Point,
+    lengths
+  });
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/montgomery.js
+var _0n2 = BigInt(0);
+var _1n2 = BigInt(1);
+var _2n2 = BigInt(2);
+function validateOpts(curve) {
+  validateObject(curve, {
+    P: "bigint",
+    type: "string",
+    adjustScalarBytes: "function",
+    powPminus2: "function"
+  }, {
+    randomBytes: "function"
+  });
+  return Object.freeze({ ...curve });
+}
+function montgomery(curveDef) {
+  const CURVE = validateOpts(curveDef);
+  const { P, type, adjustScalarBytes: adjustScalarBytes2, powPminus2, randomBytes: rand } = CURVE;
+  const is25519 = type === "x25519";
+  if (!is25519 && type !== "x448")
+    throw new Error("invalid type");
+  const randomBytes_ = rand === void 0 ? randomBytes : rand;
+  const montgomeryBits = is25519 ? 255 : 448;
+  const fieldLen = is25519 ? 32 : 56;
+  const Gu = is25519 ? BigInt(9) : BigInt(5);
+  const a24 = is25519 ? BigInt(121665) : BigInt(39081);
+  const minScalar = is25519 ? _2n2 ** BigInt(254) : _2n2 ** BigInt(447);
+  const maxAdded = is25519 ? BigInt(8) * _2n2 ** BigInt(251) - _1n2 : BigInt(4) * _2n2 ** BigInt(445) - _1n2;
+  const maxScalar = minScalar + maxAdded + _1n2;
+  const modP = (n) => mod(n, P);
+  const GuBytes = encodeU(Gu);
+  function encodeU(u) {
+    return numberToBytesLE(modP(u), fieldLen);
+  }
+  function decodeU(u) {
+    const _u = copyBytes(abytes2(u, fieldLen, "uCoordinate"));
+    if (is25519)
+      _u[31] &= 127;
+    return modP(bytesToNumberLE(_u));
+  }
+  function decodeScalar(scalar) {
+    return bytesToNumberLE(adjustScalarBytes2(copyBytes(abytes2(scalar, fieldLen, "scalar"))));
+  }
+  function scalarMult(scalar, u) {
+    const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
+    if (pu === _0n2)
+      throw new Error("invalid private or public key received");
+    return encodeU(pu);
+  }
+  function scalarMultBase(scalar) {
+    return scalarMult(scalar, GuBytes);
+  }
+  const getPublicKey = scalarMultBase;
+  const getSharedSecret = scalarMult;
+  function cswap(swap, x_2, x_3) {
+    const dummy = modP(swap * (x_2 - x_3));
+    x_2 = modP(x_2 - dummy);
+    x_3 = modP(x_3 + dummy);
+    return { x_2, x_3 };
+  }
+  function montgomeryLadder(u, scalar) {
+    aInRange("u", u, _0n2, P);
+    aInRange("scalar", scalar, minScalar, maxScalar);
+    const k = scalar;
+    const x_1 = u;
+    let x_2 = _1n2;
+    let z_2 = _0n2;
+    let x_3 = u;
+    let z_3 = _1n2;
+    let swap = _0n2;
+    for (let t = BigInt(montgomeryBits - 1); t >= _0n2; t--) {
+      const k_t = k >> t & _1n2;
+      swap ^= k_t;
+      ({ x_2, x_3 } = cswap(swap, x_2, x_3));
+      ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
+      swap = k_t;
+      const A = x_2 + z_2;
+      const AA = modP(A * A);
+      const B = x_2 - z_2;
+      const BB = modP(B * B);
+      const E = AA - BB;
+      const C = x_3 + z_3;
+      const D = x_3 - z_3;
+      const DA = modP(D * A);
+      const CB = modP(C * B);
+      const dacb = DA + CB;
+      const da_cb = DA - CB;
+      x_3 = modP(dacb * dacb);
+      z_3 = modP(x_1 * modP(da_cb * da_cb));
+      x_2 = modP(AA * BB);
+      z_2 = modP(E * (AA + modP(a24 * E)));
+    }
+    ({ x_2, x_3 } = cswap(swap, x_2, x_3));
+    ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
+    const z2 = powPminus2(z_2);
+    return modP(x_2 * z2);
+  }
+  const lengths = {
+    secretKey: fieldLen,
+    publicKey: fieldLen,
+    seed: fieldLen
+  };
+  const randomSecretKey = (seed) => {
+    seed = seed === void 0 ? randomBytes_(fieldLen) : seed;
+    abytes2(seed, lengths.seed, "seed");
+    return seed;
+  };
+  const utils = { randomSecretKey };
+  Object.freeze(lengths);
+  Object.freeze(utils);
+  return Object.freeze({
+    keygen: createKeygen(randomSecretKey, getPublicKey),
+    getSharedSecret,
+    getPublicKey,
+    scalarMult,
+    scalarMultBase,
+    utils,
+    GuBytes: GuBytes.slice(),
+    lengths
+  });
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/oprf.js
+var _DST_scalarBytes = /* @__PURE__ */ asciiToBytes(_DST_scalar);
+function createOPRF(opts) {
+  validateObject(opts, {
+    name: "string",
+    hash: "function",
+    hashToScalar: "function",
+    hashToGroup: "function"
+  });
+  validatePointCons(opts.Point);
+  const { name, Point, hash } = opts;
+  const { Fn: Fn2 } = Point;
+  const hashToGroup = (msg, ctx) => opts.hashToGroup(msg, {
+    DST: concatBytes2(asciiToBytes("HashToGroup-"), ctx)
+  });
+  const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes2(_DST_scalarBytes, ctx) });
+  const randomScalar = (rng = randomBytes) => {
+    const t = mapHashToField(rng(getMinHashLength(Fn2.ORDER)), Fn2.ORDER, Fn2.isLE);
+    return Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
+  };
+  const msm = (points, scalars) => pippenger(Point, points, scalars);
+  const getCtx = (mode) => concatBytes2(asciiToBytes("OPRFV1-"), new Uint8Array([mode]), asciiToBytes("-" + name));
+  const ctxOPRF = getCtx(0);
+  const ctxVOPRF = getCtx(1);
+  const ctxPOPRF = getCtx(2);
+  function encode(...args) {
+    const res2 = [];
+    for (const a of args) {
+      if (typeof a === "number")
+        res2.push(numberToBytesBE(a, 2));
+      else if (typeof a === "string")
+        res2.push(asciiToBytes(a));
+      else {
+        abytes2(a);
+        res2.push(numberToBytesBE(a.length, 2), a);
+      }
+    }
+    return concatBytes2(...res2);
+  }
+  const inputBytes = (title, bytes) => {
+    abytes2(bytes, void 0, title);
+    if (bytes.length > 65535)
+      throw new Error(`"${title}" expected Uint8Array of length <= 65535, got length=${bytes.length}`);
+    return bytes;
+  };
+  const hashInput = (...bytes) => hash(encode(...bytes, "Finalize"));
+  function getTranscripts(B, C, D, ctx) {
+    const Bm = B.toBytes();
+    const seed = hash(encode(Bm, concatBytes2(asciiToBytes("Seed-"), ctx)));
+    const res2 = [];
+    for (let i = 0; i < C.length; i++) {
+      const Ci = C[i].toBytes();
+      const Di = D[i].toBytes();
+      const di = hashToScalarPrefixed(encode(seed, i, Ci, Di, "Composite"), ctx);
+      res2.push(di);
+    }
+    return res2;
+  }
+  function computeComposites(B, C, D, ctx) {
+    const T = getTranscripts(B, C, D, ctx);
+    const M = msm(C, T);
+    const Z = msm(D, T);
+    return { M, Z };
+  }
+  function computeCompositesFast(k, B, C, D, ctx) {
+    const T = getTranscripts(B, C, D, ctx);
+    const M = msm(C, T);
+    const Z = M.multiply(k);
+    return { M, Z };
+  }
+  function challengeTranscript(B, M, Z, t2, t3, ctx) {
+    const [Bm, a0, a1, a2, a3] = [B, M, Z, t2, t3].map((i) => i.toBytes());
+    return hashToScalarPrefixed(encode(Bm, a0, a1, a2, a3, "Challenge"), ctx);
+  }
+  function generateProof(ctx, k, B, C, D, rng) {
+    const { M, Z } = computeCompositesFast(k, B, C, D, ctx);
+    const r = randomScalar(rng);
+    const t2 = Point.BASE.multiply(r);
+    const t3 = M.multiply(r);
+    const c = challengeTranscript(B, M, Z, t2, t3, ctx);
+    const s = Fn2.sub(r, Fn2.mul(c, k));
+    return concatBytes2(...[c, s].map((i) => Fn2.toBytes(i)));
+  }
+  function verifyProof(ctx, B, C, D, proof) {
+    abytes2(proof, 2 * Fn2.BYTES);
+    const { M, Z } = computeComposites(B, C, D, ctx);
+    const [c, s] = [proof.subarray(0, Fn2.BYTES), proof.subarray(Fn2.BYTES)].map((f) => Fn2.fromBytes(f));
+    const t2 = Point.BASE.multiply(s).add(B.multiply(c));
+    const t3 = M.multiply(s).add(Z.multiply(c));
+    const expectedC = challengeTranscript(B, M, Z, t2, t3, ctx);
+    if (!Fn2.eql(c, expectedC))
+      throw new Error("proof verification failed");
+  }
+  function generateKeyPair() {
+    const skS = randomScalar();
+    const pkS = Point.BASE.multiply(skS);
+    return { secretKey: Fn2.toBytes(skS), publicKey: pkS.toBytes() };
+  }
+  function deriveKeyPair(ctx, seed, info) {
+    abytes2(seed, 32, "seed");
+    info = inputBytes("keyInfo", info);
+    const dst = concatBytes2(asciiToBytes("DeriveKeyPair"), ctx);
+    const msg = concatBytes2(seed, encode(info), Uint8Array.of(0));
+    for (let counter = 0; counter <= 255; counter++) {
+      msg[msg.length - 1] = counter;
+      const skS = opts.hashToScalar(msg, { DST: dst });
+      if (Fn2.is0(skS))
+        continue;
+      return {
+        secretKey: Fn2.toBytes(skS),
+        publicKey: Point.BASE.multiply(skS).toBytes()
+      };
+    }
+    throw new Error("Cannot derive key");
+  }
+  const wirePoint = (label, bytes) => {
+    const point = Point.fromBytes(bytes);
+    if (point.equals(Point.ZERO))
+      throw new Error(label + " point at infinity");
+    return point;
+  };
+  function blind(ctx, input, rng = randomBytes) {
+    input = inputBytes("input", input);
+    const blind2 = randomScalar(rng);
+    const inputPoint = hashToGroup(input, ctx);
+    if (inputPoint.equals(Point.ZERO))
+      throw new Error("Input point at infinity");
+    const blinded = inputPoint.multiply(blind2);
+    return { blind: Fn2.toBytes(blind2), blinded: blinded.toBytes() };
+  }
+  function evaluate(ctx, secretKey, input) {
+    input = inputBytes("input", input);
+    const skS = Fn2.fromBytes(secretKey);
+    const inputPoint = hashToGroup(input, ctx);
+    if (inputPoint.equals(Point.ZERO))
+      throw new Error("Input point at infinity");
+    const unblinded = inputPoint.multiply(skS).toBytes();
+    return hashInput(input, unblinded);
+  }
+  const oprf = Object.freeze({
+    generateKeyPair,
+    deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxOPRF, seed, keyInfo),
+    blind: (input, rng = randomBytes) => blind(ctxOPRF, input, rng),
+    blindEvaluate(secretKey, blindedPoint) {
+      const skS = Fn2.fromBytes(secretKey);
+      const elm = wirePoint("blinded", blindedPoint);
+      return elm.multiply(skS).toBytes();
+    },
+    finalize(input, blindBytes, evaluatedBytes) {
+      input = inputBytes("input", input);
+      const blind2 = Fn2.fromBytes(blindBytes);
+      const evalPoint = wirePoint("evaluated", evaluatedBytes);
+      const unblinded = evalPoint.multiply(Fn2.inv(blind2)).toBytes();
+      return hashInput(input, unblinded);
+    },
+    evaluate: (secretKey, input) => evaluate(ctxOPRF, secretKey, input)
+  });
+  const voprf = Object.freeze({
+    generateKeyPair,
+    deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxVOPRF, seed, keyInfo),
+    blind: (input, rng = randomBytes) => blind(ctxVOPRF, input, rng),
+    blindEvaluateBatch(secretKey, publicKey, blinded, rng = randomBytes) {
+      if (!Array.isArray(blinded))
+        throw new Error("expected array");
+      const skS = Fn2.fromBytes(secretKey);
+      const pkS = wirePoint("public key", publicKey);
+      const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
+      const evaluated = blindedPoints.map((i) => i.multiply(skS));
+      const proof = generateProof(ctxVOPRF, skS, pkS, blindedPoints, evaluated, rng);
+      return { evaluated: evaluated.map((i) => i.toBytes()), proof };
+    },
+    blindEvaluate(secretKey, publicKey, blinded, rng = randomBytes) {
+      const res2 = this.blindEvaluateBatch(secretKey, publicKey, [blinded], rng);
+      return { evaluated: res2.evaluated[0], proof: res2.proof };
+    },
+    finalizeBatch(items, publicKey, proof) {
+      if (!Array.isArray(items))
+        throw new Error("expected array");
+      const pkS = wirePoint("public key", publicKey);
+      const blindedPoints = items.map((i) => wirePoint("blinded", i.blinded));
+      const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
+      verifyProof(ctxVOPRF, pkS, blindedPoints, evalPoints, proof);
+      return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
+    },
+    finalize(input, blind2, evaluated, blinded, publicKey, proof) {
+      return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], publicKey, proof)[0];
+    },
+    evaluate: (secretKey, input) => evaluate(ctxVOPRF, secretKey, input)
+  });
+  const poprf = (info) => {
+    info = inputBytes("info", info);
+    const m = hashToScalarPrefixed(encode("Info", info), ctxPOPRF);
+    const T = Point.BASE.multiply(m);
+    return Object.freeze({
+      generateKeyPair,
+      deriveKeyPair: (seed, keyInfo) => deriveKeyPair(ctxPOPRF, seed, keyInfo),
+      blind(input, publicKey, rng = randomBytes) {
+        input = inputBytes("input", input);
+        const pkS = wirePoint("public key", publicKey);
+        const tweakedKey = T.add(pkS);
+        if (tweakedKey.equals(Point.ZERO))
+          throw new Error("tweakedKey point at infinity");
+        const blind2 = randomScalar(rng);
+        const inputPoint = hashToGroup(input, ctxPOPRF);
+        if (inputPoint.equals(Point.ZERO))
+          throw new Error("Input point at infinity");
+        const blindedPoint = inputPoint.multiply(blind2);
+        return {
+          blind: Fn2.toBytes(blind2),
+          blinded: blindedPoint.toBytes(),
+          tweakedKey: tweakedKey.toBytes()
+        };
+      },
+      blindEvaluateBatch(secretKey, blinded, rng = randomBytes) {
+        if (!Array.isArray(blinded))
+          throw new Error("expected array");
+        const skS = Fn2.fromBytes(secretKey);
+        const t = Fn2.add(skS, m);
+        const invT = Fn2.inv(t);
+        const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
+        const evalPoints = blindedPoints.map((i) => i.multiply(invT));
+        const tweakedKey = Point.BASE.multiply(t);
+        const proof = generateProof(ctxPOPRF, t, tweakedKey, evalPoints, blindedPoints, rng);
+        return { evaluated: evalPoints.map((i) => i.toBytes()), proof };
+      },
+      blindEvaluate(secretKey, blinded, rng = randomBytes) {
+        const res2 = this.blindEvaluateBatch(secretKey, [blinded], rng);
+        return { evaluated: res2.evaluated[0], proof: res2.proof };
+      },
+      finalizeBatch(items, proof, tweakedKey) {
+        if (!Array.isArray(items))
+          throw new Error("expected array");
+        const inputs = items.map((i) => inputBytes("input", i.input));
+        const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
+        verifyProof(ctxPOPRF, wirePoint("tweakedKey", tweakedKey), evalPoints, items.map((i) => wirePoint("blinded", i.blinded)), proof);
+        return items.map((i, j) => {
+          const blind2 = Fn2.fromBytes(i.blind);
+          const point = evalPoints[j].multiply(Fn2.inv(blind2)).toBytes();
+          return hashInput(inputs[j], info, point);
+        });
+      },
+      finalize(input, blind2, evaluated, blinded, proof, tweakedKey) {
+        return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], proof, tweakedKey)[0];
+      },
+      evaluate(secretKey, input) {
+        input = inputBytes("input", input);
+        const skS = Fn2.fromBytes(secretKey);
+        const inputPoint = hashToGroup(input, ctxPOPRF);
+        if (inputPoint.equals(Point.ZERO))
+          throw new Error("Input point at infinity");
+        const t = Fn2.add(skS, m);
+        const invT = Fn2.inv(t);
+        const unblinded = inputPoint.multiply(invT).toBytes();
+        return hashInput(input, info, unblinded);
+      }
+    });
+  };
+  const res = { name, oprf, voprf, poprf, __tests: Object.freeze({ Fn: Fn2 }) };
+  return Object.freeze(res);
+}
+
+// ../../node_modules/.pnpm/@noble+curves@2.2.0/node_modules/@noble/curves/ed25519.js
+var _0n3 = /* @__PURE__ */ BigInt(0);
+var _1n3 = /* @__PURE__ */ BigInt(1);
+var _2n3 = /* @__PURE__ */ BigInt(2);
+var _3n = /* @__PURE__ */ BigInt(3);
+var _5n = /* @__PURE__ */ BigInt(5);
+var _8n2 = /* @__PURE__ */ BigInt(8);
+var ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+var ed25519_CURVE = /* @__PURE__ */ (() => ({
+  p: ed25519_CURVE_p,
+  n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+  h: _8n2,
+  a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+  d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+  Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+  Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+}))();
+function ed25519_pow_2_252_3(x) {
+  const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+  const P = ed25519_CURVE_p;
+  const x2 = x * x % P;
+  const b2 = x2 * x % P;
+  const b4 = pow2(b2, _2n3, P) * b2 % P;
+  const b5 = pow2(b4, _1n3, P) * x % P;
+  const b10 = pow2(b5, _5n, P) * b5 % P;
+  const b20 = pow2(b10, _10n, P) * b10 % P;
+  const b40 = pow2(b20, _20n, P) * b20 % P;
+  const b80 = pow2(b40, _40n, P) * b40 % P;
+  const b160 = pow2(b80, _80n, P) * b80 % P;
+  const b240 = pow2(b160, _80n, P) * b80 % P;
+  const b250 = pow2(b240, _10n, P) * b10 % P;
+  const pow_p_5_8 = pow2(b250, _2n3, P) * x % P;
+  return { pow_p_5_8, b2 };
+}
+function adjustScalarBytes(bytes) {
+  bytes[0] &= 248;
+  bytes[31] &= 127;
+  bytes[31] |= 64;
+  return bytes;
+}
+var ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function uvRatio(u, v) {
+  const P = ed25519_CURVE_p;
+  const v3 = mod(v * v * v, P);
+  const v7 = mod(v3 * v3 * v, P);
+  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+  let x = mod(u * v3 * pow, P);
+  const vx2 = mod(v * x * x, P);
+  const root1 = x;
+  const root2 = mod(x * ED25519_SQRT_M1, P);
+  const useRoot1 = vx2 === u;
+  const useRoot2 = vx2 === mod(-u, P);
+  const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
+  if (useRoot1)
+    x = root1;
+  if (useRoot2 || noRoot)
+    x = root2;
+  if (isNegativeLE(x, P))
+    x = mod(-x, P);
+  return { isValid: useRoot1 || useRoot2, value: x };
+}
+var ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });
+var Fp = /* @__PURE__ */ (() => ed25519_Point.Fp)();
+var Fn = /* @__PURE__ */ (() => ed25519_Point.Fn)();
+function ed25519_domain(data, ctx, phflag) {
+  if (ctx.length > 255)
+    throw new Error("Context is too big");
+  return concatBytes(asciiToBytes("SigEd25519 no Ed25519 collisions"), new Uint8Array([phflag ? 1 : 0, ctx.length]), ctx, data);
+}
+function ed(opts) {
+  return eddsa(ed25519_Point, sha512, Object.assign({ adjustScalarBytes, zip215: true }, opts));
+}
+var ed25519 = /* @__PURE__ */ ed({});
+var ed25519ctx = /* @__PURE__ */ ed({ domain: ed25519_domain });
+var ed25519ph = /* @__PURE__ */ ed({ domain: ed25519_domain, prehash: sha512 });
+var ed25519_FROST = /* @__PURE__ */ (() => createFROST({
+  name: "FROST-ED25519-SHA512-v1",
+  Point: ed25519_Point,
+  validatePoint: (p) => {
+    p.assertValidity();
+    if (!p.isTorsionFree())
+      throw new Error("bad point: not torsion-free");
+  },
+  hash: sha512,
+  // RFC 9591 keeps H2 undecorated here for RFC 8032 compatibility. In createFROST(),
+  // `H2: ''` becomes an empty DST prefix; the built-in hashToScalar fallback treats
+  // that the same as omitted DST, even though custom hooks can still observe the empty bag.
+  H2: ""
+}))();
+var x25519 = /* @__PURE__ */ (() => {
+  const P = ed25519_CURVE_p;
+  return montgomery({
+    P,
+    type: "x25519",
+    powPminus2: (x) => {
+      const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
+      return mod(pow2(pow_p_5_8, _3n, P) * b2, P);
+    },
+    adjustScalarBytes
+  });
+})();
+var ELL2_C1 = /* @__PURE__ */ (() => (ed25519_CURVE_p + _3n) / _8n2)();
+var ELL2_C2 = /* @__PURE__ */ (() => Fp.pow(_2n3, ELL2_C1))();
+var ELL2_C3 = /* @__PURE__ */ (() => Fp.sqrt(Fp.neg(Fp.ONE)))();
+function _map_to_curve_elligator2_curve25519(u) {
+  const ELL2_C4 = (ed25519_CURVE_p - _5n) / _8n2;
+  const ELL2_J = BigInt(486662);
+  let tv1 = Fp.sqr(u);
+  tv1 = Fp.mul(tv1, _2n3);
+  let xd = Fp.add(tv1, Fp.ONE);
+  let x1n = Fp.neg(ELL2_J);
+  let tv2 = Fp.sqr(xd);
+  let gxd = Fp.mul(tv2, xd);
+  let gx1 = Fp.mul(tv1, ELL2_J);
+  gx1 = Fp.mul(gx1, x1n);
+  gx1 = Fp.add(gx1, tv2);
+  gx1 = Fp.mul(gx1, x1n);
+  let tv3 = Fp.sqr(gxd);
+  tv2 = Fp.sqr(tv3);
+  tv3 = Fp.mul(tv3, gxd);
+  tv3 = Fp.mul(tv3, gx1);
+  tv2 = Fp.mul(tv2, tv3);
+  let y11 = Fp.pow(tv2, ELL2_C4);
+  y11 = Fp.mul(y11, tv3);
+  let y12 = Fp.mul(y11, ELL2_C3);
+  tv2 = Fp.sqr(y11);
+  tv2 = Fp.mul(tv2, gxd);
+  let e1 = Fp.eql(tv2, gx1);
+  let y1 = Fp.cmov(y12, y11, e1);
+  let x2n = Fp.mul(x1n, tv1);
+  let y21 = Fp.mul(y11, u);
+  y21 = Fp.mul(y21, ELL2_C2);
+  let y22 = Fp.mul(y21, ELL2_C3);
+  let gx2 = Fp.mul(gx1, tv1);
+  tv2 = Fp.sqr(y21);
+  tv2 = Fp.mul(tv2, gxd);
+  let e2 = Fp.eql(tv2, gx2);
+  let y2 = Fp.cmov(y22, y21, e2);
+  tv2 = Fp.sqr(y1);
+  tv2 = Fp.mul(tv2, gxd);
+  let e3 = Fp.eql(tv2, gx1);
+  let xn = Fp.cmov(x2n, x1n, e3);
+  let y = Fp.cmov(y2, y1, e3);
+  let e4 = Fp.isOdd(y);
+  y = Fp.cmov(y, Fp.neg(y), e3 !== e4);
+  return { xMn: xn, xMd: xd, yMn: y, yMd: _1n3 };
+}
+var ELL2_C1_EDWARDS = /* @__PURE__ */ (() => FpSqrtEven(Fp, Fp.neg(BigInt(486664))))();
+function map_to_curve_elligator2_edwards25519(u) {
+  const { xMn, xMd, yMn, yMd } = _map_to_curve_elligator2_curve25519(u);
+  let xn = Fp.mul(xMn, yMd);
+  xn = Fp.mul(xn, ELL2_C1_EDWARDS);
+  let xd = Fp.mul(xMd, yMn);
+  let yn = Fp.sub(xMn, xMd);
+  let yd = Fp.add(xMn, xMd);
+  let tv1 = Fp.mul(xd, yd);
+  let e = Fp.eql(tv1, Fp.ZERO);
+  xn = Fp.cmov(xn, Fp.ZERO, e);
+  xd = Fp.cmov(xd, Fp.ONE, e);
+  yn = Fp.cmov(yn, Fp.ONE, e);
+  yd = Fp.cmov(yd, Fp.ONE, e);
+  const [xd_inv, yd_inv] = FpInvertBatch(Fp, [xd, yd], true);
+  return { x: Fp.mul(xn, xd_inv), y: Fp.mul(yn, yd_inv) };
+}
+var ed25519_hasher = /* @__PURE__ */ (() => createHasher(ed25519_Point, (scalars) => map_to_curve_elligator2_edwards25519(scalars[0]), {
+  DST: "edwards25519_XMD:SHA-512_ELL2_RO_",
+  encodeDST: "edwards25519_XMD:SHA-512_ELL2_NU_",
+  p: ed25519_CURVE_p,
+  m: 1,
+  k: 128,
+  expand: "xmd",
+  hash: sha512
+}))();
+var SQRT_M1 = ED25519_SQRT_M1;
+var SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
+var INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
+var ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
+var D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
+var invertSqrt = (number) => uvRatio(_1n3, number);
+var MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+var bytes255ToNumberLE = (bytes) => Fp.create(bytesToNumberLE(bytes) & MAX_255B);
+function calcElligatorRistrettoMap(r0) {
+  const { d } = ed25519_CURVE;
+  const P = ed25519_CURVE_p;
+  const mod2 = (n) => Fp.create(n);
+  const r = mod2(SQRT_M1 * r0 * r0);
+  const Ns = mod2((r + _1n3) * ONE_MINUS_D_SQ);
+  let c = BigInt(-1);
+  const D = mod2((c - d * r) * mod2(r + d));
+  let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
+  let s_ = mod2(s * r0);
+  if (!isNegativeLE(s_, P))
+    s_ = mod2(-s_);
+  if (!Ns_D_is_sq)
+    s = s_;
+  if (!Ns_D_is_sq)
+    c = r;
+  const Nt = mod2(c * (r - _1n3) * D_MINUS_ONE_SQ - D);
+  const s2 = s * s;
+  const W0 = mod2((s + s) * D);
+  const W1 = mod2(Nt * SQRT_AD_MINUS_ONE);
+  const W2 = mod2(_1n3 - s2);
+  const W3 = mod2(_1n3 + s2);
+  return new ed25519_Point(mod2(W0 * W3), mod2(W2 * W1), mod2(W1 * W3), mod2(W0 * W2));
+}
+var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
+  // Do NOT change syntax: the following gymnastics is done,
+  // because typescript strips comments, which makes bundlers disable tree-shaking.
+  // prettier-ignore
+  static BASE = /* @__PURE__ */ (() => new __RistrettoPoint(ed25519_Point.BASE))();
+  // prettier-ignore
+  static ZERO = /* @__PURE__ */ (() => new __RistrettoPoint(ed25519_Point.ZERO))();
+  // prettier-ignore
+  static Fp = /* @__PURE__ */ (() => Fp)();
+  // prettier-ignore
+  static Fn = /* @__PURE__ */ (() => Fn)();
+  constructor(ep) {
+    super(ep);
+  }
+  /**
+   * Create one Ristretto255 point from affine Edwards coordinates.
+   * This wraps the internal Edwards representative directly and is not a
+   * canonical ristretto255 decoding path.
+   * Use `toBytes()` / `fromBytes()` if canonical ristretto255 bytes matter.
+   */
+  static fromAffine(ap) {
+    return new __RistrettoPoint(ed25519_Point.fromAffine(ap));
+  }
+  assertSame(other) {
+    if (!(other instanceof __RistrettoPoint))
+      throw new Error("RistrettoPoint expected");
+  }
+  init(ep) {
+    return new __RistrettoPoint(ep);
+  }
+  static fromBytes(bytes) {
+    abytes(bytes, 32);
+    const { a, d } = ed25519_CURVE;
+    const P = ed25519_CURVE_p;
+    const mod2 = (n) => Fp.create(n);
+    const s = bytes255ToNumberLE(bytes);
+    if (!equalBytes(Fp.toBytes(s), bytes) || isNegativeLE(s, P))
+      throw new Error("invalid ristretto255 encoding 1");
+    const s2 = mod2(s * s);
+    const u1 = mod2(_1n3 + a * s2);
+    const u2 = mod2(_1n3 - a * s2);
+    const u1_2 = mod2(u1 * u1);
+    const u2_2 = mod2(u2 * u2);
+    const v = mod2(a * d * u1_2 - u2_2);
+    const { isValid, value: I } = invertSqrt(mod2(v * u2_2));
+    const Dx = mod2(I * u2);
+    const Dy = mod2(I * Dx * v);
+    let x = mod2((s + s) * Dx);
+    if (isNegativeLE(x, P))
+      x = mod2(-x);
+    const y = mod2(u1 * Dy);
+    const t = mod2(x * y);
+    if (!isValid || isNegativeLE(t, P) || y === _0n3)
+      throw new Error("invalid ristretto255 encoding 2");
+    return new __RistrettoPoint(new ed25519_Point(x, y, _1n3, t));
+  }
+  /**
+   * Converts ristretto-encoded string to ristretto point.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+   * @param hex - Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+   */
+  static fromHex(hex) {
+    return __RistrettoPoint.fromBytes(hexToBytes(hex));
+  }
+  /**
+   * Encodes ristretto point to Uint8Array.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+   */
+  toBytes() {
+    let { X, Y, Z, T } = this.ep;
+    const P = ed25519_CURVE_p;
+    const mod2 = (n) => Fp.create(n);
+    const u1 = mod2(mod2(Z + Y) * mod2(Z - Y));
+    const u2 = mod2(X * Y);
+    const u2sq = mod2(u2 * u2);
+    const { value: invsqrt } = invertSqrt(mod2(u1 * u2sq));
+    const D1 = mod2(invsqrt * u1);
+    const D2 = mod2(invsqrt * u2);
+    const zInv = mod2(D1 * D2 * T);
+    let D;
+    if (isNegativeLE(T * zInv, P)) {
+      let _x = mod2(Y * SQRT_M1);
+      let _y = mod2(X * SQRT_M1);
+      X = _x;
+      Y = _y;
+      D = mod2(D1 * INVSQRT_A_MINUS_D);
+    } else {
+      D = D2;
+    }
+    if (isNegativeLE(X * zInv, P))
+      Y = mod2(-Y);
+    let s = mod2((Z - Y) * D);
+    if (isNegativeLE(s, P))
+      s = mod2(-s);
+    return Fp.toBytes(s);
+  }
+  /**
+   * Compares two Ristretto points.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+   */
+  equals(other) {
+    this.assertSame(other);
+    const { X: X1, Y: Y1 } = this.ep;
+    const { X: X2, Y: Y2 } = other.ep;
+    const mod2 = (n) => Fp.create(n);
+    const one = mod2(X1 * Y2) === mod2(Y1 * X2);
+    const two = mod2(Y1 * Y2) === mod2(X1 * X2);
+    return one || two;
+  }
+  is0() {
+    return this.equals(__RistrettoPoint.ZERO);
+  }
+};
+Object.freeze(_RistrettoPoint.BASE);
+Object.freeze(_RistrettoPoint.ZERO);
+Object.freeze(_RistrettoPoint.prototype);
+Object.freeze(_RistrettoPoint);
+var ristretto255 = /* @__PURE__ */ Object.freeze({ Point: _RistrettoPoint });
+var ristretto255_hasher = Object.freeze({
+  Point: _RistrettoPoint,
+  /**
+  * Spec: https://www.rfc-editor.org/rfc/rfc9380.html#name-hashing-to-ristretto255. Caveats:
+  * * There are no test vectors
+  * * encodeToCurve / mapToCurve is undefined
+  * * mapToCurve would be `calcElligatorRistrettoMap(scalars[0])`, not ristretto255_map!
+  * * hashToScalar is undefined too, so we just use OPRF implementation
+  * * We cannot re-use 'createHasher', because ristretto255_map is different algorithm/RFC
+    (os2ip -> bytes255ToNumberLE)
+  * * mapToCurve == calcElligatorRistrettoMap, hashToCurve == ristretto255_map
+  * * hashToScalar is undefined in RFC9380 for ristretto, so we use the OPRF
+    version here. Using `bytes255ToNumblerLE` will create a different result
+    if we use `bytes255ToNumberLE` as os2ip
+  * * current version is closest to spec.
+  */
+  hashToCurve(msg, options) {
+    const DST = options?.DST === void 0 ? "ristretto255_XMD:SHA-512_R255MAP_RO_" : options.DST;
+    const xmd = expand_message_xmd(msg, DST, 64, sha512);
+    return ristretto255_hasher.deriveToCurve(xmd);
+  },
+  hashToScalar(msg, options = { DST: _DST_scalar }) {
+    const xmd = expand_message_xmd(msg, options.DST, 64, sha512);
+    return Fn.create(bytesToNumberLE(xmd));
+  },
+  /**
+   * HashToCurve-like construction based on RFC 9496 (Element Derivation).
+   * Converts 64 uniform random bytes into a curve point.
+   *
+   * WARNING: This represents an older hash-to-curve construction from before
+   * RFC 9380 was finalized.
+   * It was later reused as a component in the newer
+   * `hash_to_ristretto255` function defined in RFC 9380.
+   */
+  deriveToCurve(bytes) {
+    abytes(bytes, 64);
+    const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));
+    const R1 = calcElligatorRistrettoMap(r1);
+    const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));
+    const R2 = calcElligatorRistrettoMap(r2);
+    return new _RistrettoPoint(R1.add(R2));
+  }
+});
+var ristretto255_oprf = /* @__PURE__ */ (() => createOPRF({
+  name: "ristretto255-SHA512",
+  Point: _RistrettoPoint,
+  hash: sha512,
+  hashToGroup: ristretto255_hasher.hashToCurve,
+  hashToScalar: ristretto255_hasher.hashToScalar
+}))();
+var ristretto255_FROST = /* @__PURE__ */ (() => createFROST({
+  name: "FROST-RISTRETTO255-SHA512-v1",
+  Point: _RistrettoPoint,
+  validatePoint: (p) => {
+    p.assertValidity();
+  },
+  hash: sha512
+}))();
+var ED25519_TORSION_SUBGROUP = /* @__PURE__ */ Object.freeze([
+  "0100000000000000000000000000000000000000000000000000000000000000",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+  "0000000000000000000000000000000000000000000000000000000000000080",
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+  "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85",
+  "0000000000000000000000000000000000000000000000000000000000000000",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa"
+]);
+
+export {
+  ed25519,
+  ed25519ctx,
+  ed25519ph,
+  ed25519_FROST,
+  x25519,
+  _map_to_curve_elligator2_curve25519,
+  ed25519_hasher,
+  ristretto255,
+  ristretto255_hasher,
+  ristretto255_oprf,
+  ristretto255_FROST,
+  ED25519_TORSION_SUBGROUP
+};
+/*! Bundled license information:
+
+@noble/curves/abstract/edwards.js:
+@noble/curves/abstract/montgomery.js:
+@noble/curves/abstract/oprf.js:
+@noble/curves/ed25519.js:
+  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/
+//# sourceMappingURL=chunk-V7D5HJBT.js.map